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AMENDMENTS TO THE CLAIMS 

Please amend the claims by replacing the original claims with the following 
listing of claims. 

LISTING OF THE CLAIMS: 

Claims 1^1, 6-11 and 13. (Canceled) 

5. (Currently amended) The method of claim [[4]] wherein scanning for the presence 
of proscribed code of interest further comprises scanning for viral code or viral patterns. 

12. (Currently amended) The apparatus of claim [[11]] 17 , wherein said pattern 
analyzer further reviews said code for the presence of viral code or viral patterns. 

14. (New). The method of claim 13, including ascertaining in said suspect code the 
presence of one or more instructions selected from the group consisting of file open write 
and file open modify; 

setting a pointer in a code sequence containing said one or more instructions; 

setting an emergency flag; 

sending to a reporter an emergency message; and 

communicating an alert from said reporter to a recipient. 
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15. (New) A software virus detection method, comprising: 

- interpreting code that is suspected of containing proscribed code with an 
interpreter, wherein said interpreter includes a plurality of facilities for facilitating the 
interpretation of a plurality of code formats and languages in source or compiled form; 

- evaluatively writing with said interpreter the results of said interpretation, 
wherein said results of said interpretation consist of a summarily evaluation of said 
suspect code; 

- scanning the results of said interpretation for the presence of proscribed code 
and identifying proscribed code in said results, and making said results available to a 
reporter for reporting or to a processor for further processing of said results with a 
processing component; 

wherein the method includes ascertaining in said suspect code the presence of one 
or more instructions selected from the group consisting of file open write and file open 
modify; 

setting a pointer in a code sequence containing said one or more instructions; 

setting an emergency flag; 

sending to a reporter an emergency message; and 

communicating an alert from said reporter to a recipient. 



3 



U.S. Patent Application No. 09/838,979 
Response to Office Action dated: January 9, 2008 
Response Dated: July 2, 2008 

16. (New) The method of claim 15, including, when said reporter receives an emergency 
message, holding said emergency message as an initial message until completion of said 
scanning; and wherein when the results of said scan of said interpretation for the presence 
of proscribed code are negative, resetting said emergency flag. 



17. (New) A software virus detection apparatus comprising an article of manufacture 
including computer storage media that implements code, having: 

- an evaluative code interpreter for interpreting code that is suspected of 
containing proscribed code, wherein said interpreter includes a plurality of facilities for 
facilitating the interpretation of a plurality of code formats and languages in source or 
compiled form; 

- wherein said evaluative interpreter includes at least one facility for evaluatively 
writing with said interpreter the results of said interpretation, wherein said results of said 
interpretation consist of a summarily evaluation of said suspect code; 

- a pattern analyzer for scanning the results of said interpretation for the presence 
of proscribed code and [[a results evaluator]] identifying proscribed code in said results, 

- a reporter; 

wherein said results evaluator makes results available to said reporter, wherein 
said reporter reports said results to a processor for further processing of said results with 
a processing component; 
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wherein said evaluative code interpreter further reviews said code for ascertaining 
in said suspect code the presence of one or more instructions selected from the group 
consisting of file open write and file open modify; 

wherein said evaluative interpreter is configured to set a pointer in a code 
sequence containing said one or more instructions; 

wherein said evaluative interpreter is configured to set an emergency flag; and 

wherein said evaluative interpreter is configured to send to a reporter an 
emergency message. 

18. (New) The method of claim 17, wherein said reporter is configured to receive an 
emergency message, and wherein said reporter is configured to hold said emergency 
message as an initial message until completion of said scanning; and wherein when the 
results of said scan of said interpretation for the presence of proscribed code are negative, 
resetting said emergency flag. 

19. (New) The apparatus of claim 17, comprising means for communicating an alert 
from said reporter to a recipient. 
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